REDHAT-BUG-1121877: Null Pointer Dereference
First published: Tue Jul 22 2014(Updated: )
A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. An unauthenticated attacker could use this flaw to crash the server acceptor. It is reported that this issue affects version 1.5 and later. Upstream commit and further details: <a href="https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b">https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kerberos | >1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/krb5/krb5/commit/524688ce87a15fc75f87efc8c039ba4c7d5c197b
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1121879
- https://rhn.redhat.com/errata/RHSA-2014-1245.html
- https://rhn.redhat.com/errata/RHSA-2014-1389.html
- https://rhn.redhat.com/errata/RHSA-2015-0439.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1121877
Frequently Asked Questions
What is the severity of REDHAT-BUG-1121877?
The severity of REDHAT-BUG-1121877 is critical due to the potential for an unauthenticated attacker to crash the server acceptor.
How do I fix REDHAT-BUG-1121877?
To fix REDHAT-BUG-1121877, upgrade to the latest patched version of MIT Kerberos that addresses this NULL pointer dereference flaw.
Which versions of MIT Kerberos are affected by REDHAT-BUG-1121877?
REDHAT-BUG-1121877 affects MIT Kerberos versions 1.5 and later.
What type of flaw is described in REDHAT-BUG-1121877?
REDHAT-BUG-1121877 describes a NULL pointer dereference flaw in the SPNEGO acceptor.
Can REDHAT-BUG-1121877 be exploited remotely?
Yes, an unauthenticated attacker can exploit REDHAT-BUG-1121877 remotely to crash the server.
- collector/redhat-bugzilla
- alias/CVE-2014-4344
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/mit
- canonical/kerberos